Client-Server Forensic Analysis for Real-Time Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Digital Computing Systems face challenges in performing real-time or near-real-time forensic analysis due to limited resources and communication bottlenecks, which hinder the prompt detection of suspect or anomalous behavior in client machines.
Innovation Solution
A forensic analysis method that applies a data reduction model to extract a subset of data from the client machine, including user account identifiers and process and object identifiers, for real-time processing on the server, thereby reducing data volume and addressing resource limitations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all collected data from client machines is transmitted to the server for forensic analysis, then detection accuracy is improved, but communication bandwidth is overwhelmed and real-time processing becomes infeasible
Solution Approach 1:
The patent extracts only the most critical data elements from the complete forensic dataset before transmission to the server. Specifically, it identifies and extracts key indicators such as process identifiers, file operation details, registry modifications, and network connection information while filtering out redundant data. This extraction approach maintains detection accuracy by preserving essential forensic evidence while dramatically reducing data volume to enable real-time processing within communication bandwidth constraints.
Solution Approach 2:
The patent segments the forensic data collection and processing system into two distinct functional components: a client-side data collection and pre-processing module that performs local filtering and extraction, and a server-side analysis module that receives only the essential extracted data. This segmentation allows the computationally intensive filtering operations to occur at the client level, reducing the burden on server resources and communication channels while maintaining comprehensive detection capabilities at the server level.
2Measurement precision
If comprehensive data is collected and analyzed, then forensic detection accuracy is improved, but server processing resources are overwhelmed
Solution Approach 1:
The patent applies data extraction at the client level before transmission, identifying and removing redundant and less critical data elements. The extraction process focuses on preserving only the most forensically valuable data points such as process creation events, file system modifications, registry changes, and network connection details. This pre-extraction significantly reduces the data volume requiring server processing while maintaining the integrity of essential forensic evidence needed for accurate threat detection.
Solution Approach 2:
The patent performs preliminary data filtering, aggregation, and extraction operations at the client machine before data is transmitted to the server. This preliminary processing includes local analysis of collected forensic data to identify and extract only the most relevant events and anomalies. By performing these computationally intensive operations locally before transmission, the system reduces the processing burden on server resources while ensuring that the most critical forensic information is preserved for server-side analysis.
3Speed
If real-time forensic analysis is implemented, then threat detection speed is improved, but communication bottlenecks prevent prompt data transfer
Solution Approach 1:
The patent extracts only the most critical forensic data elements at the client level before transmission, creating a streamlined dataset that contains essential threat indicators while excluding redundant information. This extraction process identifies key events such as suspicious process executions, unauthorized file modifications, and anomalous network connections, transmitting only these condensed data points to the server. This approach enables real-time threat detection by ensuring that data transfer occurs at speeds sufficient for prompt analysis while maintaining the完整性 of essential forensic evidence.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
The present invention relates to a forensic analysis method performed on a Distributed Computing System (DCS) (10) comprising a server (18) and at least one client machine (14).The method comprises collecting data in a client machine (14) of the DCS (10) to form a first data set, the collected data being a function call to a resource comprised in the DCS. The method further comprises applying a data reduction model to the first data set to form a second data set and processing the second data set in the server (18) of the DCS (10) to provide for detection of suspect behaviour at the client machine (14). The data reduction model is configured to extract a subset of data from the first data set to form the second data set, the subset of data comprising: user account identifier; and process and object identifier.